Splunk Search

Improving Search Speed in Stats Query

TylerJVitale
Explorer

I'd like to run search to look at average and max values for every server over an extended period of time. Currently I'm doing

index=os sourcetype="sourcetype" source="source"|stats avg(Value) max(Value) by host

But this is taking an extremely long time to run. Is there a way to make this search more efficient?

Tags (1)
0 Karma

skoelpin
SplunkTrust
SplunkTrust

Are you running a separate search for each process? If so, you could build a simple if statement to specify the value like this

index=os
| eval CPU=if(counter="% Processor Time",'Value',"N/A")
| eval Disk=if(counter="% Free Space",'Value',"N/A")

If not then you may want to look into accelerated data models. This will run substantially faster than over the raw data

http://docs.splunk.com/Documentation/Splunk/7.1.2/Knowledge/Acceleratedatamodels

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...